Exim & Roundcube Mail Infrastructure Exploits (CVE-2023-42115 & CVE-2023-43770)

1. The Fragility of Email Infrastructure

Email remains the critical backbone of enterprise commerce: sending transactional order receipts, resetting customer passwords, and dispatching supplier purchase orders. In late 2023, critical vulnerabilities in Exim (the most widely deployed open-source Mail Transfer Agent on the internet) and Roundcube Webmail were weaponized by cyber espionage threat actors (Winter Vivern / UAC-0114) to hijack mail servers and steal authenticated sessions.

2. CVE Metadata Overview

3. Exim CVE-2023-42115: NTLM Buffer Out-of-Bounds Write

Exim included built-in support for Secure Password Authentication (SPA) / NTLM authentication. When parsing incoming NTLM authentication challenge strings, the auth_spa_server_condition function failed to validate length boundaries on user-supplied NTLM base64 tokens, allowing attackers to overwrite heap memory and achieve remote code execution on the mail server under the exim user.

4. Roundcube CVE-2023-43770: Zero-Click Stored XSS

Roundcube converted plaintext URLs into clickable HTML links using regular expressions. Due to improper escaping of single quotes within crafted email bodies, attackers injected malicious JavaScript into the DOM. When a victim opened an email, the JavaScript executed invisibly, exfiltrating the user's active session cookie and granting full access to their mailbox.

5. Remediation & Mail Server Hardening

1. Upgrade Exim MTA to version 4.96.1 or 4.97+ immediately.
2. Upgrade Roundcube Webmail to version 1.6.3 or 1.5.4+.
3. Enforce strict Content Security Policy (CSP) headers on all webmail portals to block third-party script execution and data exfiltration.